CVE-2026-76840

Name of the Vulnerable Software and Affected Versions RustDesk (affected versions not specified)

Description Windows clipboard redirection fails to perform an upper bound check when copying a peer-supplied length into a fixed-size caller buffer. When an OLE paste consumer, such as explorer.exe, calls IStream::Read with a buffer of cb bytes, the CliprdrStream Read function in libs/clipboard/src/windows/wf cliprdr.c requests data via cliprdr send request filecontents and executes CopyMemory(pv, clipboard->req fdata, clipboard->req fsize). The req fsize variable is taken directly from the peer's CLIPRDR FileContentsResponse via wf cliprdr server file contents response and is not clamped to cb. Because the length comparison req fsize < cb occurs after the copy operation, a malicious peer can send an oversized response to write arbitrary data past the end of the paste consumer's heap buffer when a local user pastes clipboard file contents from a remote side.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.